Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
29s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2023, 13:29
Static task
static1
Behavioral task
behavioral1
Sample
remittance payment.html
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
remittance payment.html
Resource
win10v2004-20230703-en
General
-
Target
remittance payment.html
-
Size
124KB
-
MD5
81afb5a1c9412a844acc331abe2db2da
-
SHA1
fdcd44789f907e3c38b4b6ead135dde759398df4
-
SHA256
1496f4195a630217125bcfe61603d5c32d3aa11cf55678e4df551452cbdc5353
-
SHA512
7b00786755f58bf8a86fcd9def3723858ad299944d6f8a6267063e46e46ba0b95b2683e3d66128ab701afe42dd0588ab0dea7a95b4a952e19028f9f6c523eea0
-
SSDEEP
3072:mk3r7+NRGyE9Je3xIVbLBiE586hcUnR3qTF8bNNG5v+2:z7+zGycCxIVbLBliMR3qA3kv+2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4876 chrome.exe 4876 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4876 chrome.exe 4876 chrome.exe -
Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 1512 4876 chrome.exe 79 PID 4876 wrote to memory of 1512 4876 chrome.exe 79 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 2696 4876 chrome.exe 81 PID 4876 wrote to memory of 1260 4876 chrome.exe 82 PID 4876 wrote to memory of 1260 4876 chrome.exe 82 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83 PID 4876 wrote to memory of 1224 4876 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" "C:\Users\Admin\AppData\Local\Temp\remittance payment.html"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9fcb9758,0x7ffd9fcb9768,0x7ffd9fcb97782⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1908,i,4004869274206286441,10089725024929958936,131072 /prefetch:22⤵PID:2696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1908,i,4004869274206286441,10089725024929958936,131072 /prefetch:82⤵PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1908,i,4004869274206286441,10089725024929958936,131072 /prefetch:82⤵PID:1224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1908,i,4004869274206286441,10089725024929958936,131072 /prefetch:12⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1908,i,4004869274206286441,10089725024929958936,131072 /prefetch:12⤵PID:3024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1908,i,4004869274206286441,10089725024929958936,131072 /prefetch:82⤵PID:3528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5116 --field-trial-handle=1908,i,4004869274206286441,10089725024929958936,131072 /prefetch:82⤵PID:1348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1908,i,4004869274206286441,10089725024929958936,131072 /prefetch:82⤵PID:4152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1908,i,4004869274206286441,10089725024929958936,131072 /prefetch:82⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1908,i,4004869274206286441,10089725024929958936,131072 /prefetch:82⤵PID:3392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1908,i,4004869274206286441,10089725024929958936,131072 /prefetch:82⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
873B
MD5cb811f8c0c3416b884c92c10f7191fac
SHA15e5115d36a79c6cb18217a919d7fd0ebb61cfa46
SHA256b2c30c41911a71b2c87de59527a95969ca6d9ae880e4754b5257d3f34274b154
SHA512df61eb4f38e2ec93c03daebd653db5c27f9ef16290c1a914fe005afe395d5cb2693661ed1388cabf0afa1349d8fcf701de9f27bafb8d6c67ce9830b6a5e8ad99
-
Filesize
6KB
MD5f0360bcc89678cb07ed638fac64ec607
SHA15e47037a9e180e06bda995ccd44b85e3b59346b9
SHA256b43f180df54c0dfa0b9f5dfcfe20cc1ab893a6c2b4b3fe8815e604a77715469e
SHA512d405c2278e654d4edb3d4f3e2d042899c7fb0e155fceb96541d68d054a92ea07a475abc20b234b7f33431687f561c5d55d22302d083393d71b504790d2624aa0
-
Filesize
173KB
MD5ec75af70766fe09708d83cedd715e6da
SHA155c87b9e05a544ab3a256e30d457c2a3d6775903
SHA256b5720cbd4daed9edd4b8556e22406403cd9cddc423f659d971e3e93fd31a4e52
SHA512f64522a194f9910c0a67c19e05149d84e35e537c27c2d12c97961cca5ccb69425ab21f0c43f4260736550139f9be05e9775e658de756b03f5d1c6f9f28190ad0
-
Filesize
89KB
MD5716e8dba4338b8b1a4bf045858b46044
SHA14b1573f099ecb9f652b211f576c48fe3aa5aaafa
SHA2562f22024c8a76a8338e0a600aa35b29414894ab0fbe427982cd4b75643ec55f34
SHA512684149b3fc9e53247cf65b7526c82e6873ba000b17c156be9d665a441950522824cdde70f836a632274326b4cdffa653701dd4f9455b29e84f3c29a13e6138f6
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84